【开源项目】使用Sa-Token框架完成API参数签名

介绍

使用 Sa-Token 内置的 sign 模块，方便的完成 API 签名创建、校验等步骤：

• 不限制请求的参数数量，方便组织业务需求代码。
• 自动补全 nonce、timestamp 参数，省时省力。
• 自动构建签名，并序列化参数为字符串。
• 一句代码完成 nonce、timestamp、sign 的校验，防伪造请求调用、防参数篡改、防重放攻击。

Java实现

引入依赖

        <dependency>
            <groupId>cn.dev33</groupId>
            <artifactId>sa-token-spring-boot-starter</artifactId>
            <version>1.35.0.RC</version>
        </dependency>

配置秘钥

sa-token: 
    sign:
        # API 接口签名秘钥 （随便乱摁几个字母即可）
        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor

请求发起端构建签名

String url = "http://b.com/api/addMoney";

// 请求参数
Map<String, Object> paramMap = new LinkedHashMap<>();
paramMap.put("userId", 10001);
paramMap.put("money", 1000);
// 更多参数，不限制数量...

// 补全 timestamp、nonce、sign 参数，并序列化为 kv 字符串
String paramStr = SaSignUtil.addSignParamsAndJoin(paramMap);

// 将参数字符串拼接在请求地址后面
url += "?" + paramStr;

// 发送请求
String res = HttpUtil.request(url);

// 根据返回值做后续处理
System.out.println("server 端返回信息：" + res);

请求接受端校验签名

@RequestMapping("addMoney")
public SaResult addMoney(long userId, long money) {

    // 1、校验请求中的签名
    SaSignUtil.checkRequest(SaHolder.getRequest());
    
    // 2、校验通过，处理业务
    System.out.println("userId=" + userId);
    System.out.println("money=" + money);
    
    // 3、返回
    return SaResult.ok();
}

原理分析

构建签名

SaSignUtil#addSignParamsAndJoin

    public static String addSignParamsAndJoin(Map<String, Object> paramsMap) {
        return SaManager.getSaSignTemplate().addSignParamsAndJoin(paramsMap);
    }

SaSignTemplate#addSignParamsAndJoin，新增签名参数

public String addSignParamsAndJoin(Map<String, Object> paramsMap) {
    paramsMap = this.addSignParams(paramsMap);
    return this.joinParams(paramsMap);
}

SaSignTemplate#addSignParams，新增了timestamp，nonce随机数和sign。

    public Map<String, Object> addSignParams(Map<String, Object> paramsMap) {
        paramsMap.put(timestamp, String.valueOf(System.currentTimeMillis()));
        paramsMap.put(nonce, SaFoxUtil.getRandomString(32));
        paramsMap.put(sign, this.createSign(paramsMap));
        return paramsMap;
    }

SaSignTemplate#createSign，创建签名。按照Map中的自然排序进行拼接

    public String createSign(Map<String, ?> paramsMap) {
        String secretKey = this.getSecretKey();
        SaSignException.throwByNull(secretKey, "参与参数签名的秘钥不可为空", 12201);
        if (((Map)paramsMap).containsKey(sign)) {
            paramsMap = new TreeMap((Map)paramsMap);
            ((Map)paramsMap).remove(sign);
        }

        String paramsStr = this.joinParamsDictSort((Map)paramsMap);
        String fullStr = paramsStr + "&" + key + "=" + secretKey;
        return this.abstractStr(fullStr);
    }

    public String joinParamsDictSort(Map<String, ?> paramsMap) {
        if (!(paramsMap instanceof TreeMap)) {
            paramsMap = new TreeMap((Map)paramsMap);
        }

        return this.joinParams((Map)paramsMap);
    }

SaSignTemplate#abstractStr，加密方式是md5。

    public String abstractStr(String fullStr) {
        return SaSecureUtil.md5(fullStr);
    }

验证签名

SaSignUtil#checkRequest，校验请求

public static void checkRequest(SaRequest request) {
    SaManager.getSaSignTemplate().checkRequest(request);
}

SaSignTemplate#checkRequest，校验请求中的参数

    public void checkRequest(SaRequest request) {
        this.checkParamMap(request.getParamMap());
    }

SaSignTemplate#checkParamMap，校验请求中的参数timestampValue，nonceValue，signValue

public void checkParamMap(Map<String, String> paramMap) {
    String timestampValue = (String)paramMap.get(timestamp);
    String nonceValue = (String)paramMap.get(nonce);
    String signValue = (String)paramMap.get(sign);
    this.checkTimestamp(Long.parseLong(timestampValue));
    if (this.getSignConfigOrGlobal().getIsCheckNonce()) {
        this.checkNonce(nonceValue);
    }

    this.checkSign(paramMap, signValue);
}

SaSignTemplate#checkTimestamp，判断在一定范围内

    public void checkTimestamp(long timestamp) {
        if (!this.isValidTimestamp(timestamp)) {
            throw (new SaSignException("timestamp 超出允许的范围：" + timestamp)).setCode(12203);
        }
    }

    public boolean isValidTimestamp(long timestamp) {
        long allowDisparity = this.getSignConfigOrGlobal().getTimestampDisparity();
        long disparity = Math.abs(System.currentTimeMillis() - timestamp);
        return allowDisparity == -1L || disparity <= allowDisparity;
    }

SaSignTemplate#checkNonce，校验随机数

    public void checkNonce(String nonce) {
        if (SaFoxUtil.isEmpty(nonce)) {
            throw new SaSignException("nonce 为空，无效");
        } else {
            String key = this.splicingNonceSaveKey(nonce);
            if (SaManager.getSaTokenDao().get(key) != null) {
                throw new SaSignException("此 nonce 已被使用过，不可重复使用：" + nonce);
            } else {
                SaManager.getSaTokenDao().set(key, nonce, this.getSignConfigOrGlobal().getSaveNonceExpire() * 2L + 2L);
            }
        }
    }

SaSignTemplate#checkSign，根据请求中的参数数据创建签名，判断和原有签名是否相同。

    public void checkSign(Map<String, ?> paramsMap, String sign) {
        if (!this.isValidSign(paramsMap, sign)) {
            throw (new SaSignException("无效签名：" + sign)).setCode(12202);
        }
    }

    public boolean isValidSign(Map<String, ?> paramsMap, String sign) {
        String theSign = this.createSign(paramsMap);
        return theSign.equals(sign);
    }

SaToken存储

SaTokenDao是存储接口。

默认实现是用的是SaTokenDaoDefaultImpl。SaTokenDaoDefaultImpl存储数据，主要是通过ConcurrentHashMap存放在本地内存中。

public class SaTokenDaoDefaultImpl implements SaTokenDao {
	

	/**
	 * 数据集合 
	 */
	public Map<String, Object> dataMap = new ConcurrentHashMap<String, Object>();

	/**
	 * 过期时间集合 (单位: 毫秒) , 记录所有key的到期时间 [注意不是剩余存活时间] 
	 */
	public Map<String, Long> expireMap = new ConcurrentHashMap<String, Long>();
	
	/**
	 * 构造函数
	 */
	public SaTokenDaoDefaultImpl() {
		initRefreshThread();
	}
	
	
	// ------------------------ String 读写操作 
	
	@Override
	public String get(String key) {
		clearKeyByTimeout(key);
		return (String)dataMap.get(key);
	}

	@Override
	public void set(String key, String value, long timeout) {
		if(timeout == 0 || timeout <= SaTokenDao.NOT_VALUE_EXPIRE)  {
			return;
		}
		dataMap.put(key, value);
		expireMap.put(key, (timeout == SaTokenDao.NEVER_EXPIRE) ? (SaTokenDao.NEVER_EXPIRE) : (System.currentTimeMillis() + timeout * 1000));
	}
}

SaTokenDaoDefaultImpl#initRefreshThread，对过期数据要定时清除

	/**
	 * 初始化定时任务 
	 */
	public void initRefreshThread() {

		// 如果配置了<=0的值，则不启动定时清理
		if(SaManager.getConfig().getDataRefreshPeriod() <= 0) {
			return;
		}
		// 启动定时刷新
		this.refreshFlag = true;
		this.refreshThread = new Thread(() -> {
			for (;;) {
				try {
					try {
						// 如果已经被标记为结束
						if(refreshFlag == false) {
							return;
						}
						// 执行清理
						refreshDataMap(); 
					} catch (Exception e) {
						e.printStackTrace();
					}
					// 休眠N秒 
					int dataRefreshPeriod = SaManager.getConfig().getDataRefreshPeriod();
					if(dataRefreshPeriod <= 0) {
						dataRefreshPeriod = 1;
					}
					Thread.sleep(dataRefreshPeriod * 1000);
				} catch (Exception e) {
					e.printStackTrace();
				}
			}
		});
		this.refreshThread.start();
	}


	/**
	 * 清理所有已经过期的key 
	 */
	public void refreshDataMap() {
		Iterator<String> keys = expireMap.keySet().iterator();
		while (keys.hasNext()) {
			clearKeyByTimeout(keys.next());
		}
	}

如果仅仅存放在本地内存中，涉及到多个项目，可能数据无法共享。

引入仓库sa-token-dao-redis-jackson。

        <dependency>
            <groupId>cn.dev33</groupId>
            <artifactId>sa-token-dao-redis-jackson</artifactId>
            <version>1.33.0</version>
        </dependency>

SaTokenDaoRedisJackson使用Redis作为存储数据的地方。

@Component
public class SaTokenDaoRedisJackson implements SaTokenDao {
    public static final String DATE_TIME_PATTERN = "yyyy-MM-dd HH:mm:ss";
    public static final String DATE_PATTERN = "yyyy-MM-dd";
    public static final String TIME_PATTERN = "HH:mm:ss";
    public static final DateTimeFormatter DATE_TIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
    public static final DateTimeFormatter DATE_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd");
    public static final DateTimeFormatter TIME_FORMATTER = DateTimeFormatter.ofPattern("HH:mm:ss");
    public ObjectMapper objectMapper;
    public StringRedisTemplate stringRedisTemplate;
    public RedisTemplate<String, Object> objectRedisTemplate;
    public boolean isInit;

    public SaTokenDaoRedisJackson() {
    }

    @Autowired
    public void init(RedisConnectionFactory connectionFactory) {
        if (!this.isInit) {
            StringRedisSerializer keySerializer = new StringRedisSerializer();
            GenericJackson2JsonRedisSerializer valueSerializer = new GenericJackson2JsonRedisSerializer();

            try {
                Field field = GenericJackson2JsonRedisSerializer.class.getDeclaredField("mapper");
                field.setAccessible(true);
                ObjectMapper objectMapper = (ObjectMapper)field.get(valueSerializer);
                this.objectMapper = objectMapper;
                this.objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
                JavaTimeModule timeModule = new JavaTimeModule();
                timeModule.addSerializer(new LocalDateTimeSerializer(DATE_TIME_FORMATTER));
                timeModule.addDeserializer(LocalDateTime.class, new LocalDateTimeDeserializer(DATE_TIME_FORMATTER));
                timeModule.addSerializer(new LocalDateSerializer(DATE_FORMATTER));
                timeModule.addDeserializer(LocalDate.class, new LocalDateDeserializer(DATE_FORMATTER));
                timeModule.addSerializer(new LocalTimeSerializer(TIME_FORMATTER));
                timeModule.addDeserializer(LocalTime.class, new LocalTimeDeserializer(TIME_FORMATTER));
                this.objectMapper.registerModule(timeModule);
                SaStrategy.me.createSession = (sessionId) -> {
                    return new SaSessionForJacksonCustomized(sessionId);
                };
            } catch (Exception var7) {
                System.err.println(var7.getMessage());
            }

            StringRedisTemplate stringTemplate = new StringRedisTemplate();
            stringTemplate.setConnectionFactory(connectionFactory);
            stringTemplate.afterPropertiesSet();
            RedisTemplate<String, Object> template = new RedisTemplate();
            template.setConnectionFactory(connectionFactory);
            template.setKeySerializer(keySerializer);
            template.setHashKeySerializer(keySerializer);
            template.setValueSerializer(valueSerializer);
            template.setHashValueSerializer(valueSerializer);
            template.afterPropertiesSet();
            this.stringRedisTemplate = stringTemplate;
            this.objectRedisTemplate = template;
            this.isInit = true;
        }
    }

    public String get(String key) {
        return (String)this.stringRedisTemplate.opsForValue().get(key);
    }

    public void set(String key, String value, long timeout) {
        if (timeout != 0L && timeout > -2L) {
            if (timeout == -1L) {
                this.stringRedisTemplate.opsForValue().set(key, value);
            } else {
                this.stringRedisTemplate.opsForValue().set(key, value, timeout, TimeUnit.SECONDS);
            }

        }
    }
}

获取和更新SaTokenDao

SaBeanInject#setSaTokenDao，SaBeanInject是自动配置的。当系统中存在SaTokenDao的Bean实例，则设置SaTokenDao实例。

@Autowired(
    required = false
)
public void setSaTokenDao(SaTokenDao saTokenDao) {
    SaManager.setSaTokenDao(saTokenDao);
}

SaManager#setSaTokenDao，设置SaTokenDao实例

	public static void setSaTokenDao(SaTokenDao saTokenDao) {
		setSaTokenDaoMethod(saTokenDao);
		SaTokenEventCenter.doRegisterComponent("SaTokenDao", saTokenDao);
	}
	
	private static void setSaTokenDaoMethod(SaTokenDao saTokenDao) {
		if((SaManager.saTokenDao instanceof SaTokenDaoDefaultImpl)) {
			((SaTokenDaoDefaultImpl)SaManager.saTokenDao).endRefreshThread();
		}
		SaManager.saTokenDao = saTokenDao;
	}

SaManager#getSaTokenDao，如果saTokenDao没有设置，则获取默认的实现SaTokenDaoDefaultImpl

	public static SaTokenDao getSaTokenDao() {
		if (saTokenDao == null) {
			synchronized (SaManager.class) {
				if (saTokenDao == null) {
					setSaTokenDaoMethod(new SaTokenDaoDefaultImpl());
				}
			}
		}
		return saTokenDao;
	}